Senior Cybersecurity Risk & Vulnerability Management Advisor

Vanguard; Lees (PA); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Vanguard Group is seeking an experienced security leader to drive vulnerability risk management and remediation across our technology environment. The role interfaces with GTO, Enterprise Security, and various technical teams to translate complex security findings into clear business risk and to enable strategic outcomes.

Ideal candidates will have extensive IT security or development background, strong communication with senior leadership, and expertise in cloud and infrastructure security,

Qualifications

• Eight years of related IT security or application development experience.
• Undergraduate degree in a related field or equivalent experience.
• Ability to translate complex technical and security information into clear business-risk narratives.
• Strong written and verbal communication with executive presence.
• Strong technical acumen in infrastructure and cloud operations.
• Knowledge of cybersecurity frameworks, especially NIST, and identifying gaps.

Responsibilities

• Lead vulnerability risk management and remediation oversight across tech environments.
• Develop and communicate vulnerability posture and remediation deadlines to senior leadership.
• Serve as technical risk liaison between GTO and security stakeholders.
• Translate technical findings into actionable business-risk information for tech teams.
• Drive cross-functional remediation initiatives across GTO, security, infra, and engineering.
• Partner with infrastructure, networking, platform teams for root-cause analysis.
• Develop and lead security assessment plans to evaluate controls.
• Work with IT subdivisions and vendors to assess security risks and impacts.
• Evaluate security requirements for data systems, networks, and websites.
• Escalate and resolve vulnerabilities near remediation deadlines; manage vendor relationships.
• Maintain knowledge of emerging security practices and lead Security Champion engagement.

Skills

Leadership

Stakeholder communication

Risk management

Cloud security

NIST frameworks

Governance

Vendor management

Security reporting

BISO familiarity

IT controls

Education

Bachelor's degree in related field

Tools

Archer

Wiz

Qualys

Tableau

Microsoft 365

Job description

Core Responsibilities:

• Leads vulnerability risk management and remediation oversight across technology environments. Analyzes infrastructure vulnerability data to validate risk, applicability, ownership, remediation status, and reporting accuracy; identifies themes and actionable insights; and performs targeted outreach to drive resolution.

• Develops and communicates vulnerability posture, trends, remediation deadlines, and material exposures to senior leadership. Monitors security dashboards and risk metrics, investigates reporting discrepancies, and improves reporting accuracy.

• Serves as the technical risk liaison between GTO (Global Technology Operations) and security stakeholders, helping infrastructure operations teams navigate the security organization, clarify security dependencies, remove roadblocks, and enable strategic outcomes.

• Translates technical findings into actionable business-risk information and advises technology teams on security requirements, risk-treatment decisions, and enterprise security initiatives.

• Drives cross-functional remediation initiatives and coordinates resolution of high-risk security findings across GTO, Enterprise Security, infrastructure, application, engineering, technology owners, and supporting teams.

• Partners with infrastructure, networking, platform, and other technology teams to perform root-cause analysis of vulnerabilities, identify security control or process gaps, and recommend security practices that help prevent, detect, and remediate future issues.

• Develops and leads security assessment plans to evaluate the adequacy of information security controls. Identifies vulnerabilities, integration requirements and implications, emerging security needs, and appropriate corrective measures.

• Works with IT subdivisions, third-party partners, and business units to assess and communicate security risks and the operational impacts of technology implementations.

• Evaluates security requirements for data systems, networks, and websites; identifies enterprise technical security solutions; and coordinates adoption of security initiatives and solutions.

• Facilitates escalation and resolution of vulnerabilities approaching remediation deadlines or requiring additional management attention and manages vendor relationships.

• Maintains knowledge of emerging security practices, standards, policies, and industry trends and leads engagement and enablement of the Security Champion community.

• Participates in special projects and performs other duties as assigned.

Qualifications:

• Minimum eight years of related work experience. Experience in IT security or application development preferred.

• Undergraduate degree in a related field or equivalent combination of training and experience.

• Demonstrated experience interfacing with, presenting to, and reporting to senior-level leadership, with the ability to translate complex technical and security information into clear, actionable business-risk narratives.

• Strong written and verbal communication skills, executive presence, and the ability to communicate effectively with technical and non-technical stakeholders.

• Strong technical acumen and understanding of infrastructure and cloud operations, with the ability to effectively partner with infrastructure and other technical teams.

• Knowledge of cybersecurity frameworks and security best practices, particularly NIST, with the ability to identify control and process gaps and recommend corrective actions.

Preferred Experience & Skills:

• Previous experience as a Business Information Security Officer (BISO), IT Risk Manager, IT Controls Manager, or in a similar technical security governance and reporting role.

• Experience supporting technology or infrastructure organizations in a security, risk, controls, or governance capacity.

• Familiarity with cloud computing concepts and ITIL.

• Familiarity with security and risk platforms such as Archer, Wiz, and Qualys.

• Experience utilizing reporting and productivity tools such as Tableau and Microsoft 365. Tableau experience is preferred but not required.

• Security certification such as ISC2 CISSP, GIAC Security Essentials Certification (GSEC), GIAC Penetration Tester Certification (GPEN), GIAC Web App Pen Tester (GWPN), or Certified Ethical Hacker (CEH) preferred.

• Strong relationship-management, persuasion, and influencing capabilities across security and technology stakeholders.

Special Factors

Sponsorship

Vanguard is not offering visa sponsorship for this position.

About Vanguard

At Vanguard, we don't just have a mission—we're on a mission.

To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.